tree 0a6b762e24d06c5891d0eea9baf81b1a2df07a18
parent e98c7aeac61252c94b0454bb081c96cf3b0bc9d6
author Anthony Stange <stange@google.com> 1607549441 -0500
committer Anis Assi <anisassi@google.com> 1612550312 -0800

Use strong pointer in ALooper to avoid use-after-free

If the endpoint that has a reference to the ASensorEventQueue goes away
without calling ASensorManager_destroyEventQueue, then the event queue's
reference goes to 0. This causes the event queue to be destroyed, but
the looper may still call it since it hasn't been invalidated yet
causing a use-after-free.

To avoid this, store the event queue as a weak pointer in the looper's
queue and attempt to promote it to a strong pointer when it needs to be
used. If it can't be promoted, then it is ignored and cleared later.

Bug: 175074139
Test: Load Android firmware image and run the camera app to verify no
crashes are seen.

Merged-In: I1439bf9c0a725818889f7be64e234d952363f4db
Change-Id: I1439bf9c0a725818889f7be64e234d952363f4db
(cherry picked from commit 7d712cfe6ddf86c07c4f2baee74ec948c7fc72d0)